Proof · Notes
Engineering notes
Patterns we learned while building a multi-tenant evidence vault for SOC 2–style delivery. Placeholders only — no stack fingerprints. Engineering commentary, not audit or legal advice.
-
2026-09-03 · 01
WAF and Lambda Function URLs: put CloudFront in front
Function URLs do not take a regional WAF ACL. CloudFront plus a CloudFront-scoped web ACL — and a branded hostname — keeps CSP honest.
-
2026-09-03 · 02
Stop putting execute-api in your CSP
Browsers should only see api.yourdomain.com. Point the CNAME at the API Gateway custom-domain target — not the API ID hostname — or TLS fails.
-
2026-09-03 · 03
Why authenticated downloads lose their file extensions
HTTP API CORS must expose Content-Disposition (and friends). Otherwise Save-As falls back to the UI title and drops .tf / .md.
-
2026-09-03 · 04
Tenant isolation without a bucket per customer
Prefix-bound object keys, identical 404s for missing and forbidden, and per-tenant KMS on a shared bucket — dedicated buckets as a contract add-on.
Prefer primary sources? See our curated insights reading list. How we deliver: methodology.